CVE-2017-8449

CVE-2017-8449 affects Elastic X-Pack Security 5.2.x (Elasticsearch/Kibana). When field-level security rules for the same index are merged with a mix of grant and exclude rules, a user could see more fields than permitted. This has been documented by SUSE and OpenVAS plugins, with CVSS base scores...

CVE-2017-8450

CVE-2017-8450 concerns Elastic Stack: Elastic Kibana X-Pack 5.1.1. The issue is an information-disclosure vulnerability where document and field level security were not properly enforced for multi-search and multi-get requests, potentially allowing users without access to certain documents/fields...

CVE-2017-8451

Kibana with X-Pack is affected by CVE-2017-8451, exposing an open redirect on the login page in versions before 5.3.1. The vulnerability details and exact remediation are not fully described in the provided documents; upgrade information beyond “before 5.3.1” is not specified here.

CVE-2017-8449: Incorrect Permission Assignment for Critical Resource

X-Pack Security 5.2.x would allow access to more fields than the user should have seen if the field level security rules used a mix of grant and exclude rules when merging multiple rules with field level security rules for the same index...

PT-2017-18341

Name of the Vulnerable Software and Affected Versions X-Pack Security versions 5.2.x Description The issue allows access to more fields than the user should have seen when the field level security rules use a mix of grant and exclude rules, specifically when merging multiple rules with field leve...

PT-2017-18342

Name of the Vulnerable Software and Affected Versions Elasticsearch X-Pack version 5.1.1 Description The issue concerns improper application of document and field level security to multi-search and multi-get requests. This could allow users without access to a document and/or field to access this...

PT-2017-7880

Name of the Vulnerable Software and Affected Versions Kibana versions 5.0.0 through 5.0.1 Description The issue concerns improper authentication of requests to advanced settings and the short URL service in Kibana when X-Pack is installed. This allows any authenticated user to make requests to...

CVE-2017-8450: Incorrect Permission Assignment for Critical Resource

X-Pack 5.1.1 did not properly apply document and field level security to multi-search and multi-get requests so users without access to a document and/or field may have been able to access this information...

CVE-2016-10364: Missing Authentication for Critical Function

With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings and the short URL service, any authenticated user could make requests to those services regardless of their own permissions...

CVE-2017-8451: URL Redirection to Untrusted Site

With X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website...

ElasticSearch X-Pack Security Elevation of Privilege Vulnerability

ElasticSearch X-Pack is an extension of the Elastic Stack log analysis system from the Dutch company Elasticsearch. security is one of the features used to control access rights. An elevation of privilege vulnerability exists in the runas feature in ElasticSearch X-Pack Security versions 5.0.0...

ElasticSearch X-Pack Security Information Disclosure Vulnerability

ElasticSearch X-Pack is an extension of the Elastic Stack log analysis system from the Dutch company Elasticsearch. security is one of the features used to control access rights. An information disclosure vulnerability exists in ElasticSearch X-Pack Security versions prior to 5.4.1 and versions...

CVE-2017-8438

Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the runas functionality. This bug prevents transitioning into the specified user specified in a runas request. If a role has been created using a template that contains the user properties, the behavior of runas...

Design/Logic Flaw

Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the runas functionality. This bug prevents transitioning into the specified user specified in a runas request. If a role has been created using a template that contains the user properties, the behavior of runas...

CVE-2017-8438

Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the runas functionality. This bug prevents transitioning into the specified user specified in a runas request. If a role has been created using a template that contains the user properties, the behavior of runas...

CVE-2017-8441

Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug could allow a user with restricted permissions to view data they should not have access to when performing certain operations against an index alias...

Design/Logic Flaw

Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug could allow a user with restricted permissions to view data they should not have access to when performing certain operations against an index alias...

CVE-2017-8438

Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the runas functionality. This bug prevents transitioning into the specified user specified in a runas request. If a role has been created using a template that contains the user properties, the behavior of runas...

CVE-2017-8441

Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug could allow a user with restricted permissions to view data they should not have access to when performing certain operations against an index alias...

CVE-2017-8441

The CVE-2017-8441 issue affects Elastic X-Pack Security: versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This could allow a user with restricted permissions to view data they should not access when performing certain operations against an...